Sign a gateway request

Cloudgate signature authentication uses HMAC-SHA512 over the timestamp, method, path with query, and exact request body. The client sends the API key, timestamp, and hexadecimal signature as headers.

Build the signing payload#

Concatenate these values without separators:

timestamp + UPPERCASE_METHOD + pathname_and_query + raw_body

The timestamp is Unix time in milliseconds. The gateway checks it against a 30-second window, so the client clock must be accurate. The path includes /sbx/ or /prod/ and the query string, but not the scheme or hostname.

Node.js example#

This example calls the GET action from the quickstart. Supply credentials through the server process environment and use your actual API hostname.

import { createHmac } from "node:crypto";

const url = new URL(
  "/sbx/getting-started/hello",
  process.env.CLOUDGATE_API_ORIGIN
);
const method = "GET";
const body = "";
const timestamp = String(Date.now());
const payload = timestamp + method + url.pathname + url.search + body;
const signature = createHmac("sha512", process.env.CLOUDGATE_API_SECRET)
  .update(payload, "utf8")
  .digest("hex");

const response = await fetch(url, {
  method,
  headers: {
    "X-Api-Key": process.env.CLOUDGATE_API_KEY,
    "X-Timestamp": timestamp,
    "X-Authentication-Signature": signature
  }
});
if (!response.ok) throw new Error(`Request failed: ${response.status}`);
console.log(await response.json());

Sign the bytes you send#

For a POST or PUT, serialize the body once, include that exact string in the payload, and send the same string as the request body. Set Content-Type: application/json for JSON.

Do not reformat JSON after signing. Whitespace, query ordering, escaping, and trailing slashes can change the signature. Generate a fresh timestamp for a new request rather than replaying an old signed example.

Troubleshoot rejection#

Check the key's environment and action scope first. Then compare method, path/query, body serialization, timestamp units, and clock drift. A correct signature can still be rejected by an access rule or request limit.

Use the generated Postman collection to compare a known request configuration without logging the secret itself.